Red Hat Security Advisory

RHSA-2025:3647

tomcat security update

Released 2025-04-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.9.4) tomcat-1:9.0.87-1.el9_4.3, tomcat-admin-webapps-1:9.0.87-1.el9_4.3, tomcat-docs-webapp-1:9.0.87-1.el9_4.3 +5

Fixes 2 records

TI-2025-18529 CVE-2025-24813 · GHSA-83qj-6fr2-vhqg

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

CRITICAL 100KEV

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99942 Published 2025-03-10 Partial fix · 11.0.3, 10.1.35 +1 CWE-44

TI-2024-33814 CVE-2024-50379 · GHSA-5j33-cvvr-w245

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

HIGH 82

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configura…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.31824 Published 2024-12-17 Partial fix · 11.0.2, 10.1.34 +1 CWE-367